В общем я использую настройку для метода .ajax по установке csrf в заголовок.
$.ajaxSetup({
beforeSend: function(xhr, settings) {
function getCookie(name) {
var cookieValue = null;
if (document.cookie && document.cookie != '') {
var cookies = document.cookie.split(';');
for (var i = 0; i < cookies.length; i++) {
var cookie = jQuery.trim(cookies[i]);
// Does this cookie string begin with the name we want?
if (cookie.substring(0, name.length + 1) == (name + '=')) {
cookieValue = decodeURIComponent(cookie.substring(name.length + 1));
break;
}
}
}
return cookieValue;
}
if (!(/^http:.*/.test(settings.url) || /^https:.*/.test(settings.url))) {
// Only send the token to relative URLs i.e. locally.
xhr.setRequestHeader("X-CSRFToken", getCookie('csrftoken'));
}
}
});
Безопасен ли будет такой код для авторизации и регистрации?
(document).ready(function() {
$('#login').click(function() {
username = $("#username").val();
password = $("#password").val();
$.ajax({
url: "/forum/login/",
method: "POST",
data: {
username: username,
password: password
},
dataType: "json"
}).done(
Проверил в дебагере, вроде нормально всё!?
Content-Type application/javascript
Date Sat, 16 Aug 2014 09:43:45 GMT
Server WSGIServer/0.1 Python/2.7.3
Set-Cookie csrftoken=kGgWaMQzIPiqATys5hyz3OHA9jDP7VIW; expires=Sat, 15-Aug-2015 09:43:45 GMT; Max-Age=31449600; Path=/ sessionid=2ormkicml6diib88cotrslp95cljic67; expires=Sat, 30-Aug-2014 09:43:45 GMT; httponly; Max-Age=1209600; Path=/
Vary Cookie
X-Frame-Options SAMEORIGIN
показать исходный код
Accept application/json, text/javascript, */*; q=0.01
Accept-Encoding gzip, deflate
Accept-Language en-US,en;q=0.5
Content-Length 30
Content-Type application/x-www-form-urlencoded; charset=UTF-8
Cookie csrftoken=VmlhLXkVMQPVuDaXdiF2moGLjOUhUz9R; sessionid=j2uvosctppmndod5pjpmjj52ar2vhz3v
Host 127.0.0.1:8000
Referer http://127.0.0.1:8000/forum/
User-Agent Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:30.0) Gecko/20100101 Firefox/30.0
X-CSRFToken VmlhLXkVMQPVuDaXdiF2moGLjOUhUz9R
X-Requested-With XMLHttpRequest
